Work phones: the security basics
Your staff's phones hold company email, files and MFA approvals. Six habits that keep work phones from becoming the weak spot.
Most businesses lock down their computers and forget about phones. Yet the phone in your pocket probably has company email on it, files from OneDrive or SharePoint, and the authenticator app that approves your sign-ins. If it is lost, stolen or compromised, so is a lot of the business.
Treat work phones like work computers. These six habits cover most of the risk.
1. Keep the phone and its apps updated
Updates close security holes that attackers already know about. Turn on automatic updates for the operating system and apps, and restart the phone at least once a week so they actually install.
Phones stop getting security updates after a few years. Check whether a phone still gets them before you hand it to a new starter. If it no longer does, it should not be holding company data.
2. Lock it properly
Use a six-digit passcode or longer, plus Face ID or a fingerprint. Set the screen to lock after a minute or two. A phone that opens with a swipe is an open door to company email.
3. Install apps from the official store only
Fake apps copy the look and the reviews of real ones. Stick to the Apple App Store or Google Play, check the publisher name, and be wary of any app that asks for more access than it needs. A torch app has no business reading your contacts.
4. Be careful on public Wi-Fi
Cafe and airport Wi-Fi can be set up by anyone. Use your phone’s own mobile data for anything work-related, or a VPN your IT provider has set up. Never sign in to work accounts on a network you do not trust.
5. Skip public USB charging points
A USB port can carry data as well as power. Use your own charger and a power point, or carry a small power bank.
6. Never send passwords or card details by text
Text messages and many chat apps are not a safe place for passwords, bank details or anything you would not want forwarded. Use your password manager’s secure sharing, or pick up the phone.
What to do if a work phone is lost
Act the same day:
- Tell your IT provider straight away so company access can be removed from the device.
- Change the password for the person’s Microsoft 365 account.
- Remove the lost phone from their MFA methods and set up the replacement.
- Report it to the carrier so the SIM can be blocked.
If you would like a hand working out where your team’s phones stand, book a meeting.